CVE-2017-3194

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

PortSwigger Web Security: Improper Certificate Validation

1 Obtained a key from PortSwigger official site. 2 Downloaded latest version of burp 1.7.29 from PortSwigger and activated license. 3 Downloaded previous version of burp v1.7.17 and used same key for the activation. And, I was able to activate license on the old version of BurpSuite. Impact Singl...

CVE-2017-8213

Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00 has an input validation vulnerability when handle TLS and DTLS handshake with certificate. Due to the...

NixOS NixOS LDAP SSL Certificate Validation Default Vulnerability

NixOS is a distribution of the Linux system. A security vulnerability exists in NixOS 17.03 and earlier versions. A remote attacker can exploit this vulnerability to conduct a man-in-the-middle attack and steal a user's password hash or service account credentials in plaintext...

CVE-2014-2845

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

Design/Logic Flaw

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

CVE-2014-2845

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

CVE-2014-2845

The CVE-2014-2845 entry applies to Cyberduck for Windows prior to 4.4.4, where the client does not properly validate X.509 certificate chains. This flaw allows MITM when using FTP-SSL because certificates issued by untrusted roots may be accepted. The NVD description and the SySS advisory confirm...

Mitsui Sumitomo Insurance SumaHo application for Android certificate validation vulnerability

Mitsui Sumitomo Insurance SumaHo application for Android is an Android-based insurance product management application from Mitsui Sumitomo Insurance in Japan. A certificate validation vulnerability exists in versions 3.0.0 and earlier of the Mitsui Sumitomo Insurance SumaHo application for Androi...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...

ALPINE-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

DEBIAN-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

Twitter iOS client information disclosure vulnerability

Twitter iOS client is an iOS-based mobile client program for accessing the Twitter social network and micro blogs. A security vulnerability exists in versions 6.62 and 6.62.1 of the iOS-based Twitter client, which stems from the program failing to validate Twitter's server certificate. A remote...

Red Hat MRG ovirt-engine certificate validation security bypass vulnerability

Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

libvirt TLS Certificate Validation Vulnerability

libvirt is a set of free , open source support for the mainstream virtualization tools under Linux C function library . A TLS certificate validation vulnerability exists in Libvirt 2.3.0 and later. The vulnerability is caused by an error in the default configuration "verify-peer=no" passed to QEM...

Google Golang Go Certificate Validation Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in Google Golang Go versions 1.7.3 and 1.6.3. A remote attacker can exploit this vulnerability to authenticate a connection with the help of...

Juniper SRX Series Appliance Junos OS Denial of Service Vulnerability

The Juniper SRX series device is a series of firewall products from Juniper Networks, Inc.Junos OS is the operating system that runs on them. A security vulnerability exists in Junos OS versions 12.1X46, 12.3X48, and 15.1X49 on Juniper SRX series devices, which arises from a program that fails to...

WolfSSL CyaSSL Certificate Validation Bypass Vulnerability

WolfSSL CyaSSL is the United States WolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A certificate validation bypass vulnerability exists in WolfSSL CyaSSL. A remote attacker can exploit this vulnerability to spoof a server with a speciall...